type.inbound
// google drawings link
and any(body.current_thread.links,
.href_url.domain.domain == "docs.google.com"
and strings.istarts_with(.href_url.path, '/drawings')
and (
strings.icontains(.href_url.path, '/preview')
or any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence != "low"
)
)
)
and profile.by_sender_email().prevalence == "new"
Playground
Test against your own EMLs or sample data.